Every service that sends mail with your domain in the envelope sender needs to be listed in your SPF record: the office mail platform, the newsletter tool, the ticket system, the web shop and the server in the rack that sends invoices. Forget one and its mail starts failing SPF; add too many includes and the whole record breaks with a PermError. Writing v=spf1 records by hand in a DNS panel is where many of these mistakes happen.
The SPF Record Generator builds the record from checkboxes and lists, validates every address and domain as you type, counts the DNS lookups the record causes directly and explains what each choice means. It runs entirely in your browser. Use it when you set up a new domain, add or remove a sending service, or want to replace an SPF record that has grown messy over the years.
What is an SPF record generator?
In simple terms
SPF (Sender Policy Framework) is a published list of the servers allowed to send mail for your domain. A receiving mail server looks up that list and checks whether the server that just connected to it is on it. The generator is a form that writes this list in the exact syntax receivers expect, so you only have to decide who sends mail for you, not how to spell it.
Technical background
SPF is defined in RFC 7208. A record is a TXT record on the domain that starts with v=spf1, followed by mechanisms that are evaluated left to right:
ip4:andip6:match a single address or a CIDR range and cost no DNS lookup.aandmxmatch the domain's own A/AAAA addresses or its MX hosts; each costs one lookup.include:evaluates another domain's SPF record (typically a provider's) and costs at least one lookup, plus whatever that record contains.allmatches everything and is always last. Its qualifier decides what happens to mail from servers not listed before it:-(fail),~(softfail),?(neutral) or+(pass).
Receivers check SPF against the envelope sender (MAIL FROM, also called Return-Path) or, when that is empty, the HELO name. RFC 7208 caps evaluation at 10 DNS-querying terms (include, a, mx, ptr, exists, redirect); going over is a PermError, which DMARC treats as an SPF failure. A single TXT string is limited to 255 characters, so longer records are published as several strings in one record.
SPF alone does not protect the visible From: address. That is DMARC's job, which requires SPF or DKIM to pass for a domain aligned with From:. A correct SPF record is one of the two building blocks.
Why use an SPF record generator?
- Avoid syntax errors. A missing space, a stray
include:prefix in a domain list or an invalid CIDR prefix silently breaks evaluation. The generator validates each IPv4/IPv6 address and prefix and each include domain before it adds it. - Stay under the 10-lookup limit. The tool counts the lookups your record causes directly and flags the record as invalid above 10, with a warning from 8 upward.
- Pick the right
allpolicy. Each option is explained in place, and+allis not offered at all. - Handle long records. When the record exceeds 255 characters you get the correctly split, quoted form ready to paste.
- Catch overly broad ranges. An
ip4:range wider than /16 triggers a warning with the number of addresses it authorizes.
Who should use it?
- Administrators setting up email authentication for a new domain or migrating to a new mail provider.
- IT teams adding a marketing, CRM, helpdesk or transactional mail service.
- Consultants and MSPs who prepare DNS changes for clients and want a reviewed, consistent record.
- Anyone who has to fix an SPF record reported as invalid by SPF Lookup or the Email Health Check.
How the SPF generator works
Everything happens in JavaScript in your browser; nothing you type is sent to NetTools.tech. Each change in the form rebuilds the record immediately:
- The record starts with
v=spf1. - If ticked,
aand thenmxare added. - Each IPv4 entry is validated (address, optional prefix 0–32) and added as
ip4:; each IPv6 entry likewise (prefix 0–128) asip6:. Duplicates are removed. - Selected providers and the domains in "Other includes" are validated as public domain names and added as
include:mechanisms. - The
allqualifier you chose is appended last.
Then the checks run: the direct lookup count (include terms plus a and mx), the 255-character split, a warning above 450 characters (very long SPF answers can exceed DNS UDP response limits), and notes about the chosen policy. If any entry is invalid, the record is dimmed and the copy button is disabled until you fix it, so you cannot accidentally copy a broken record.
The generator never queries DNS. It cannot see how many lookups each provider's include adds, and it does not read your currently published record. Those checks belong to SPF Lookup, which evaluates the published record recursively on the NetTools.tech server.
How to use the NetTools.tech SPF generator
- Open the SPF Record Generator.
- Optionally enter Your domain. It is only used to show where to publish the record (
@ (example.com)). - Under Mail services that send for you, tick each provider you use: Google Workspace (
_spf.google.com), Microsoft 365 (spf.protection.outlook.com), Amazon SES (amazonses.com), SendGrid (sendgrid.net), Mailgun (mailgun.org) or Mailchimp / Mandrill (servers.mcsv.net). Confirm the value with each provider's documentation. - Under Your own servers, tick MX servers if your inbound mail servers also send mail, and Domain's A/AAAA address if the web server at the domain itself sends mail.
- Enter IPv4 addresses or ranges and IPv6 addresses or ranges, one per line (for example
192.0.2.10or198.51.100.0/24). - Add any other provider in Other includes, one domain per line, without the
include:prefix. - Choose what should happen to mail from other servers: Fail
-all, Soft fail~all(the default, recommended while rolling out) or Neutral?all. - Read the messages under the record, then press Copy record and publish it as a TXT record at the host shown.
- After the change has propagated, verify it with SPF Lookup.
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
Type TXT · Host @ | Where the record goes: a TXT record on the domain itself | Do not create a second TXT record starting with v=spf1; replace the existing one |
| Record | The assembled v=spf1 … record, in the order a, mx, ip4, ip6, include, all | Dimmed text means an error must be fixed first |
| Quoted strings | Shown instead of a single line when the record is longer than 255 characters | Paste all strings into one TXT record; many DNS panels split long values automatically |
N chars · N/10 lookups | Record length and the lookups the record causes directly | The real total is higher if includes contain further lookups |
| Error messages | An invalid IP, prefix or domain, or more than 10 direct lookups | The copy button stays disabled until all errors are fixed |
| Warning: authorizes N addresses | An ip4: range shorter than /16 | Make sure you really want to authorize that many addresses |
| Warning: 8–10 lookups | Close to the limit before nested includes are counted | Check the published record with SPF Lookup; consider removing unused services |
Info: ~all / warning: ?all | Explains the chosen policy | ?all provides no protection against spoofing |
| Info: no senders | The record contains only v=spf1 and the all term | v=spf1 -all states that the domain sends no email, which is correct for parked domains |
Example: office mail, a newsletter service and one server
Suppose example.com uses Google Workspace for staff mail, SendGrid for newsletters, its MX hosts relay outgoing mail for a few devices, and a billing server at 192.0.2.10 plus a small range 198.51.100.0/24 send directly. With MX servers, Google Workspace and SendGrid ticked, the two IPv4 entries and Soft fail selected, the generator produces:
v=spf1 mx ip4:192.0.2.10 ip4:198.51.100.0/24 include:_spf.google.com include:sendgrid.net ~allThe counter shows 94 chars · 3/10 lookups (mx plus two includes), with two notes: that each include can trigger further lookups and should be checked with SPF Lookup, and that ~all is a common starting point before moving to -all. Published as TXT at @, the equivalent check from a command line is:
dig +short TXT example.comOnce DMARC aggregate reports confirm that all legitimate mail passes, the same form with Fail selected produces the identical record ending in -all.
Common use cases
- New domain: build the first SPF record together with a DMARC record and DKIM key.
- Adding a sending service: tick the provider or add its include, then check the lookup count before publishing.
- Cleaning up: rebuild a record that accumulated old includes and single IPs over the years, keeping only current senders.
- Parked or non-sending domains: generate
v=spf1 -all(no senders, Fail) to tell receivers the domain never sends mail. - Change preparation: produce the exact record text for a change ticket or a client's DNS administrator.
Troubleshooting
The copy button is disabled
At least one entry is invalid: an IP address with a typo, a prefix out of range (/33), a domain with an invalid character, or more than 10 direct lookups. The error message names the entry. Fix or remove it and the button becomes active again.
SPF Lookup reports "too many DNS lookups" although the generator showed 4/10
The generator only counts lookups in your own record. Provider includes often contain nested includes of their own, and each of those counts too. Run SPF Lookup on the published record to see the full tree and total. Reduce the count by removing services you no longer use, or replace a/mx with explicit ip4:/ip6: entries where the addresses are stable.
Mail still fails SPF after publishing
Check that the old record was replaced rather than a second v=spf1 record added, that DNS has propagated (see Email DNS Propagation with the SPF record type), and that the failing mail really uses your domain in the envelope sender. Many services send with their own bounce domain, in which case your SPF record is not consulted and DMARC must pass through DKIM instead.
The DNS panel rejects the value
Some panels expect the value without surrounding quotes, others add quotes themselves, and some refuse values over 255 characters unless split. Try the single-line form first; if the panel complains about length, paste the quoted strings form.
Common mistakes
- Publishing a second SPF record for a new service instead of merging it into the existing one.
- Typing
include:in the "Other includes" box; enter only the domain. - Using
-allbefore every sender is listed, which can make legitimate mail fail at receivers that honor SPF fail. - Ticking MX servers by habit when the inbound servers never send mail, wasting a lookup and authorizing hosts unnecessarily.
- Authorizing a whole provider network range with a short prefix instead of using the provider's include.
- Expecting SPF to survive forwarding. Forwarded mail arrives from the forwarder's server, so SPF usually fails there; DKIM is what survives.
Limitations
- The generator does not query DNS. It cannot count lookups inside includes, detect void lookups or compare with your published record.
- The provider list contains six common services with their usual default include. Accounts with regional or custom values must use "Other includes".
- Only
a,mx,ip4,ip6,includeandallare supported;exists,ptr,redirectand macros are not generated.ptris discouraged by RFC 7208 anyway. aandmxare added without a domain or prefix argument, so they always refer to the domain the record is published on.- The result is a suggestion. Whether it is right depends on whether you listed every real sender, which only your own inventory and DMARC reports can confirm.
Security & privacy
The SPF generator runs completely in your browser. The domain, IP addresses and include domains you enter are not uploaded or stored by NetTools.tech, and no DNS query is made. SPF records are public information once published, so there is nothing secret about the content, but internal IP plans are still yours to keep: only enter the public addresses that actually send mail. The tool never needs passwords, API keys or account access to your DNS provider.
Related tools
- SPF Lookup – validate the published record, expand includes and count all lookups (guide).
- DMARC Record Generator – build the policy that makes SPF results count for the From: domain (guide).
- DKIM Record Generator – create the signing key that survives forwarding (guide).
- Email DNS Propagation – see whether resolvers already return your new SPF record (guide).
- Email Health Check – check MX, SPF, DMARC and transport security together (guide).
- Email tools overview – how the email tools fit together.
Summary
An SPF record lists the servers allowed to send mail for your domain, and small syntax or lookup-count mistakes make it fail entirely. The NetTools.tech SPF Record Generator builds the record in your browser from providers, IP ranges and an all policy, validates every entry and counts direct lookups. Because it cannot see inside provider includes or your published DNS, verify the result with SPF Lookup after publishing.
Frequently asked questions
Where do I publish an SPF record?
As a TXT record on the domain itself, which most DNS panels call the host @ or leave blank. SPF is not published on a subdomain such as _spf unless you are deliberately building an include for other domains to reference.
Should I use -all or ~all?
-all (fail) tells receivers that unlisted servers are not authorized, while ~all (softfail) asks them to accept but treat the mail with suspicion. Many domains start with ~all while they confirm that every legitimate sender is listed, then move to -all once DMARC reports look clean.
Why does the generator not offer +all?
+all authorizes every server on the internet to send as your domain, which makes the SPF record meaningless. The generator only offers -all, ~all and ?all, and it warns that ?all gives receivers no useful guidance either.
Can I have two SPF records on one domain?
No. RFC 7208 requires a single v=spf1 record per name, and receivers return a PermError when they find more than one. If you add a new service, merge its include into your existing record instead of publishing a second one.
Why does the generator say the lookup count is only a minimum?
The generator counts the lookups your own record causes directly: one for each include, plus one each for a and mx. Every include can contain further includes, a or mx terms that also count against the limit of 10, and those are only visible after publishing, for example with SPF Lookup.
Does the SPF generator check my current DNS record?
No. It builds a new record from what you enter and never queries DNS. To see what is published today, including nested includes and the total lookup count, run SPF Lookup on the domain before and after you change it.
Why is my record shown as several quoted strings?
A single DNS TXT string can hold at most 255 characters. When the record is longer, the generator splits it into several quoted strings that belong in one TXT record; receivers join them back together without spaces.
Are the provider include values always correct?
They are the common published defaults for Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailgun and Mailchimp/Mandrill. Providers can use account-specific or regional values, so confirm the exact include in each provider's documentation before you publish.